Chinese Threat Actor Exploits PHP2Shell and Firewall Flaw to Compromise 24 U.S. Government‑Affiliated Firewalls
What Happened — Researchers from GreyNoise and Dream observed at least six successful exploits of the newly disclosed PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619 (collectively “PHP2Shell”). The attackers chained PHP2Shell with a separate Linux‑based firewall vulnerability (CVE‑2026‑46300) to gain root access on 24 internet‑facing firewalls that host U.S. government‑affiliated services. Exploitation took place primarily on 23‑24 Oct 2026; the actors planted custom web‑shells, harvested credentials, and enumerated directories. The campaign was attributed to a Chinese group based on language, tooling, and the use of Chinese AI models. Patches for the PHP bugs were added to the U.S. government’s catalog of exploited vulnerabilities, with agencies given a short window to remediate.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management control that ensures rapid identification, assessment, and remediation of known flaws.
Who Is Affected — Federal agencies and any organization running PHP‑enabled web services or vulnerable firewall appliances.
Recommended Actions
- Verify that patches for CVE‑2026‑109618, CVE‑2026‑109619, and CVE‑2026‑46300 are applied across all web‑servers and firewalls.
- Deploy continuous vulnerability scanning and automated patch‑deployment pipelines.
- Correlate asset inventory with vulnerability data to prioritize remediation of internet‑facing assets.
- Capture remediation evidence (patch logs, scan reports) for audit readiness.
Technical Notes
- Attack vector: exploitation of PHP2Shell web‑shells (CVE‑2026‑109618/109619) chained with a Linux firewall privilege‑escalation bug (CVE‑2026‑46300).
- Data exposed: administrator credentials and directory listings from compromised firewalls.
- Impact: root‑level command execution on 24 firewalls, credential theft, potential lateral movement.